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1. INTRODUCTION 

Trends in Information Technology (IT) maximization within organizational business investment has 
arisen recently due to increasing demands of quality service and cost minimization from the community, 
the market, and within the organization itself [1-3]. The introduction of IT application within an organization 
is known to boost the organizational business value within its main and subsidiary activities. On top of that, 
IT is employed as a strategic means to enhance an organization’s competitive advantage during times of 
uncertainty [4, 5]. This contributes to surging dependency of the IT-friendly work environment, by which an 
effective IT management compatible with business goals is essential to ensure the organization’s success. 

Engaging in the education sector, Universitas Negeri Gorontalo (UNG) has implemented IT within 
its operational processes, 1.e., its academic information system, personnel information system, library 
information system, performance information systems for lecturers, financial information system, 
and administrative information system. The information systems are employed as a means of providing 
advanced quality service to the users (students, personnels, and lecturers) contributing as a part within 
the organizational business strategy to prepare for increasingly high competitive atmosphere. Quality service 
is crucial in accordance with high demands of user satisfaction and to improve the organization’s image in its 
users. This complies with Kotler and Fox arguing that providing quality service to the clients contributes 
positively to increase satisfaction and loyalty and that both are important factors that differentiate 
the organization’s product from its competitors [6]. 
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Limited resources (e.g., application, information, technology, facilities, and human resources) are 
essential elements to consider when implementing IT within an organization, in which it costs an 
organization considerably high expense to implement IT [7]. An organization’s capability to conduct 
IT management is the primary determinant of quality of IT service, as it does not solely rely on technology. 
IT service also involves users and complex processes within. Moreover, an assessment of maturity level of IT 
service implementation is critical to identify and measure the extent of quality of IT service in providing 
effective management and support to the business process. The assessment involves best practice framework, 
1.e., COBIT 5 within the domain of delivery, service, and support (DSS). 

The assessment of maturity level is intended for an organization to identify the maturity level of IT 
to be used as a benchmark to enhance the quality of IT service and to ensure the availability of IT service in 
addressing to current and further business needs. Moreover, the assessment is essential in order for 
the organization to be capable of analyzing strength and weakness and to formulate strategies in addressing 
the gap, maintaining decent organizational governance, and minimizing potential risks [8, 9]. By that, 
the organization is expected to be capable in interpreting business target and goals, by which the organization 
can prioritize certain business operational activities, mainly in determining effective IT service to support 
the optimal outcomes of IT governance. 

a. IT governance 

Implementation of IT has been one of the decisive factors in maintaining and broadening 
organizational strategies and goals. This creates a critical dependency of IT within every segment of work 
environment; thus requiring more focused study, mainly on IT governance [10]. The statement is echoed by 
a global survey result from McKinsey on 2014 reporting that 35 percents of IT executives have agreed that 
improving governance process and supervision is critical to improving IT performance. It is essential for an 
organization in public and private sector to perform IT governance effectively, by which the organization is 
required to conduct several adjustments on policy and regulations within macroeconomics and in ICT 
sector [11]. Consequently, one of the critical determinants to consider in IT governance is to provide steady 
and capable IT so that the organization can maintain, support, and to broaden organizational strategies 
and goals. 

IT governance is defined by ITGI as the responsibility of executives and the board of directors; 
it consists of the leadership, organizational structures, and processes ensuring that the enterprise’s IT sustains 
and extends the organization’s strategies and objective [12]. IT governance is the combination of 
best practices of planning & organization, procurement & implementation, delivery & support, and 
supervision & evaluation of IT in which it ensures that the organizational information and technology are 
capable of supporting the organizational business goals [13]. Moreover, classify IT governance into two 
aspects, 1.€., functional aspect, involving structure and processes considered as an organizational design 
element; and social aspect, which involves human behavior and organizational culture [14]. Based on 
the framework, this study defines that IT governance is the whole aspects needed to ensure that IT system 
maintains and broaden organizational strategies and goals, by which IT governance is considered as an 
integral part of organizational governance. 

Surging demands of information within decision-making process have increased the need for 
a comprehensive IT governance structure [15], for an effective IT governance structure can contribute to 
the improvement of organizational business value. This is important as an effective prerequisite to 
the organizational governance. Therefore the roles and responsibilities of the parties involved must be clearly 
defined [16]. Most of the maturity models used for IT governance are related to the existing business 
frameworks. These frameworks only emphasize processes and structures [17]. Of all business frameworks for 
maturity model, COBIT is the only framework that put its focus on IT governance [14]. 

b. Maturity level 

The Merriam-Webster encyclopedia defines maturity as “the quality or state of being mature.” In 
the meantime, the maturity level is defined as the description of maturity of IT processes within an 
organization considered as benchmark and self-assessment tool by IT management in assessing the extent of 
maturity of implementation of IT [18, 19]. Maturity process is among the key elements in COBIT business 
framework. It is the assessment tool to determine the extent of IT management process. COBIT framework 
features a maturity model to conduct control on IT processes involving scoring process, by which 
the organization is able to scale its IT processes, ranging from 0 (nonexistent) to 5 (optimized) [12]. By 
assessing the level of maturity process, the organization has been made possible to determine which 
processes are under control and which processes that represent potential management challenges [20]. 
Assessment of maturity level is a part of propriety test on the existing activity and IT processes in accordance 
with its level. 

In COBIT version 4.1, the concept of maturity level applied is capability maturity model (CMM). It 
is replaced in COBIT version 5 by the model of process capability based on standards of ISO/IEC 15504 
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(SPICE) - information technology process assessment [21]. COBIT assessment is designed to feature 
repeatable, reliable, and valid methodology for the organization to assess the capability of its IT process [21]. 
Model of process capability in COBIT 5 is based on ISOMIEC 15504 (SPICE) by employing Process 
Assessment Model (PAM) method. The model assesses the performance of evaluate, direct, and 
monitor-based (EDM) governance processes and plan, build, run, and monitor-based (PBRM) management 
process, and is capable of identifying sectors that need performance upgrade. 

Capability process model is employed to ensure that the assessment result is objective, impartial, 
consistent, repeatable, and able to represent assessed processes [22, 23]. The maturity level in COBIT 5 is 
expressed on a scale ranging from 0 (incomplete) to 5 (optimizing), as presented in Table 1 [21]. 


Table 1. Levels to assess the maturity in Cobit 5 


Capability Level Achieve 
Level 0: Incomplete The process is not implemented or fails to achieve its process purpose 
Level 1: Performed (Informed) The implemented process achieves its process purpose; 
Level 2: Managed (Planned and monitored). The process is managed and results are specified, controlled and maintained; 
Level 3: Established (Well defined) A standard process is defined and used throughout the organization; 
Level 4: Predictable (Quantitatively managed) The process is executed consistently within defined limits 
Level 5: Optimizing (Continuous The process is continuously improved to meet relevant current and projected 
improvement) business goals. 


2. RESEARCH METHOD 
2.1. Planning 

Research plan is the plan and procedure for carrying out researches, involving general assumption, 
research strategy, a method of data collection, and detailed analysis [24]. Referring to the research plan, 
the research strategy applied is a quantitative method, involving literature study, observation, and 
questionnaire as a technique of collecting data. Moreover, the research employed phases of the research plan 
(Figure 1), i.e. preliminary study through literature and case study. A literature study was conducted to grasp 
a comprehensive insight of IT governance, management, organization, and COBIT 5 framework. The case 
study took place in UNG by identifying business environment within the organization. From the research 
plan this study extracted the requirements, target, and strategic objects in accordance with processes within 
DSS domain the result is further treated as a reference in formulating questions within questionnaire form, by 
also referring to best practice standard of DSS domain of COBIT 5 framework within ISACA. 
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Figure 1. Research procedure 


2.2. Population and sample 

Samples were obtained by non-probability sampling by saturated sampling technique due to research 
elements were selected randomly and proven capable to comply with pre-existing factors. On top of that, 
the technique generates result capable of being generalized with minimum errors [25]. The samples were 
selected from the population of 57 people consisting of leaders and staffs which qualify the requirements to 
participate in this research. Saturated sampling technique allows the whole population to be treated as 
a sample. Saturated sampling is defined as a technique for selecting sample if the whole population is treated 
as a sample [24]. Therefore, the research also involves the 57 people as its samples. 


2.3. Instrument formulation and procedures 

The formulation of research instruments for DSS domain is based on PAM model in COBIT 5 
framework [21]. This domain is related to the actual delivery and required service support which involves 
service, security and maintenance management, service support for the users, and data management and 
operational facilities. The assessment scale of every question involved scoring as shown in Table 1. 
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2.4. Assessment 

This step involved elaboration of the research findings, such as for as the current situation of IT 
service management within the organization in every process of DSS domain. During this phase, an analysis 
was also conducted to identify any gaps in order to compare and adjust the maturity level with the targeted 
level. The analysis was employed on every process within DSS domain of IT, from which the research 
formulates recommendations for further management upgrades of IT service. These recommendations 
are further treated as guidelines in formulating upgrades on service processes and support of IT within 
the institution capable of fulfilling and exceeding current and further organizational business needs. 


3. RESULTS AND ANALYSIS 
The data analysis step requires normally distributed data in order to ensure the data validity and free 
from any biases. 


3.1. Results 

Based on p-plot graph normality test, it shows that the data are normally distributed and meet 
the requirements for further analyses. When the data follow or approach the diagonal line, the data is 
considered normal to be distributed by examining p-plot diagram, skewness value, and that kurtosis level is 
in between -2 or +2. The normality test result shows that the data are evenly distributed by skewness value of 
-0.835 and kurtosis level of 0.085, which is in the range of +2. 

Moreover, the analysis employs data validity and reliability test. Validity test is defined as a test 
conducted on research instrument formulated, to measure the extent to which an instrument is able to 
accurately assess certain concepts which are needed to be assessed [25, 26]. The instrument is considered 
valid if it can be used to measure what is needed to be measured. The research employed product moment 
Pearson validity test to assess the validity of its instrument. The validity test results in Tfcount > Ttable With 
a significant rate of 5% in between 0.809 and 0.924; therefore, the instrument is considered valid. 

Further, instrument reliability is related to the uniformity of results when the research object is 
repeatedly measured. Reliability 1s an extent to which errors in the instrument are minimized as possible in 
order to produce consistent outcomes [27, 28]. To perform reliability test of research instrument, the research 
employs Cronbach’s Alpha coefficient analysis. The result illustrates that the value of Cronbach’s Alpha 
coefficient ranges from 0.6 to 0.7 within the acceptable minimum rate of reliability [29]. Referring to 
the result of data analysis which shows that Cronbach’s Alpha value is in 0.93, hence, the research instrument 
is considered to be reliable. 

Table 2 illustrates the result of data processing which shows the maturity level assessment of IT 
service within DSS domain of DSSO1, DSSO2, DSO3, DSS04, DSSO5, and DSS06 process. Figure 2 indicates 
the graph of current, expected and maximum maturity level within DSS01, DSSO2, DSSO3, DSSO4, DSSO5, 
and DSS06 domain process. 


Table 2. The average score of maturity level within DSS process domain 





Domain process Activity Maturity level _ Expected level | Maximum level 
DSSO1 Manage Operations 3.43 4 5 
DSS02 Manage Service Requests and Incidents 3.31 4 5 
DSS03 Manage Problems 3.26 4 5 
DSS04 Manage Continuity 3.34 4 5 
DSS05 Manage Security Services 3.34 4 5 
DSS06 Manage Business Process Controls 3.44 4 5 

DSS01 
5 a 


—e Maturity Level 
—e— Expected Level 


== Maximum Level 





Figure 2. Graph of a DSS process capability level 
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3.2. Analysis 


a. 


Maturity level assessment of IT service 
From the data analysis and the result of maturity level assessment of IT service within process 


domain DSSO1 to DSS06, it is indicated that: 


Process domain DSSOI (manage operations) possesses maturity level of 3.43. The process is in level 3 
established (well-defined), which denotes that the IT service process has been well-implemented by 
referring to the defined standard process and made possible to achieve positive outcomes. The maturity 
level implies that there is a surging need of IT-friendly work environment in managing organizational 
processes. This is illustrated by the availability of IT devices to support the performance academic and 
other systems within the organization, e.g., the availability of blade server to support the systems’ 
performance. Within this level, the need for computer operational management is addressed accurately 
within the organization. In addition, the organization has allocated IT resources and conducted trainings 
for the IT-related personnels. Further, the organization has accurately addressed the need of IT asset 
maintenance, by which the organization released limited access policy to allow IT facilities only 
accessible by certain IT-related personnels. 

Within process domain DSS02 (manage service requests and incidents), the maturity level scores 
3.31, which suggests that the process is in level 3 Established (well-defined). The maturity level 
points out that the process of the IT service has been implemented by referring to the defined standard 
process; this allows the process to achieve positive outcomes. It is observable from the effective support 
by the management board to respond to the need of management system and from the availability of 
financial support for the supporting staffs when conducting trainings. Moreover, the organization 
has resolved the need for helpdesk function and service and issue management within the unit. 
The organization also has prepared users’ guideline for IT service and documentation for every 
issue indications. 

Within process domain DSSO3 (manage problems), the maturity level scores 3.26, which demonstrates 
that the process is in level 3 Established (well-defined). The maturity level denotes that the process of 
the IT service has been implemented by referring to the defined standard process and this made possible 
for the process to achieve positive outcomes. It is noticeable from raising awareness of the importance to 
manage issues, and from the efforts strived to identify the roots of the issues in IT service. On top of that, 
the escalation process of handling issues in IT service is standardized. The problem-solving steps have 
involved issue documentation and identification employed by response team engaging centralized tools. 
Process domain DSSO4 (manage continuity) possesses maturity level of 3.34. The process is in level 3 
Established (well-defined), in which it points out that the IT service process has been well-implemented 
by referring to the defined standard process and made possible to achieve positive outcomes. This 
signifies that the responsibilities for the planning of service continuity and test are clearly defined and 
designated to the respective staffs within the organization. Moreover, the result denotes accountable 
management of service continuity. IT continuity plans are well-documented referring to critical elements 
of the system and organizational business impact. Moreover, the management board performs consistent 
communication with the staffs on the importance of planning to maintain the continuity of IT service. In 
the meantime, the organization has implemented high availability of components and backup system. 
Within process domain DSSO5 (manage security services), the maturity level scales 3.34 in level 3 
Established (well-defined). The result illustrates that the IT service process has been well-implemented by 
referring to the defined standard process; by which it allows the process to achieve positive outcomes. It 
is apparent that the organization possesses comprehensive and awareness of the significance of ensuring 
the IT security, in which responsibilities and accountability are determined, managed and understood to 
ensure IT security. Further, the organization has established procedures for IT security in accordance with 
IT security policy, in which the security report involves coherent business focus. The management board 
also engages steps to minimize and address risks sustainably. 

Process domain DSS06 (manage business process control) shows maturity level of 3,44 in level 3 
Established (well-defined), which symbolizes that the IT service process has been well-implemented by 
referring to the defined standard process and made possible to achieve positive outcomes. It is depicted in 
enhancements by the organization to address issues in information control and development of 
comprehensive management of environmental quality. On top of that, environmental control of 
the organization is engaged proactively, one of which includes a commitment to facilities and awareness 
of IT security. The organization also possess a responsible and accountable structure which have 
the privilege of access to IT services in accordance with the capabilities and skills required to develop 
technology infrastructure plan. 
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b. Gap analysis of maturity level of IT 

The average results of the assessment of IT service maturity level within the process domains 
DSSO1 to DSSO6 depict current average maturity level on level 3 (Established). It is the condition in which 
processes of IT service have been implemented by standard procedure and achieved a positive outcome, have 
communicated and implemented by all academicians. Therefore, the organization should enhance its 
performance of IT service, involving policy, implementation, and conformity to progress to level 4 maturity 
(predictable), as shown in Figure 3 as follows. Moreover, the organization requires to perform adjustments to 
achieve desired maturity level. 

The biggest gap occurs in DSSO3 (manage problem) domain, in which the maturity level is 3.26. 
Conversely, the smallest gap is shown in the DSS06 domain, which scales 3.44 in the maturity level. 
The existing gap within DSSO3 domain signifies the lacks of comprehension within every level of 
the organization towards management process on issues of IT service. This is echoed by rather unstable 
quality of service to users and hindrances due to the personnels’ limited knowledge within each 
organizational unit. Henceforth, the overall result of maturity level assessment of IT service demonstrates 
that the current maturity level is quite distant from the desired level, 1.e., level 4 (predictable). 


—e— Maturity Level 


—e— Expected Level 





DSS04 


Figure 3. Radar diagram of DSS process capability level 


c. Recommendations 
This study recommends that: 

- The organization requires to formulate and ratify policy of Standard Operating Procedure (SOP) of IT 
service management, due to the deficiency of comprehensive SOP within each organizational unit. 
The SOP is critical to formulating as a guideline of process and implementation of IT governance within 
the organization. By that, it allows the organization to implement comprehensive and detailed 
documentation of every process, job desk, and role of individuals or groups within the organization. 

- It is crucial for the organization to engage in the clear and well-structured standardization of 
governance and management to minimize potential gaps in data and information flows needed when 
formulating policy. 

- Enhancement in IT service system is essential within every work unit of the organization in accordance 
with the characteristics of IT service of each unit. 

- The organization is required to implement integration with pre-existing applications to validate data, 
from which it provides ease for the users to experience service of the accurate and effective 
information accessing. 

- Upgrade and optimization in ICT service system are vital for the organization to conduct to achieve 
good governance. 


4. CONCLUSION 

The overall score of the current maturity level of IT service is in scale 3 (established) out of 
level 5 scale (optimizing). The overall result reveals that IT service processes are implemented and 
documented referring to the defined standard process, in which it allows the organization to achieve positive 
outcomes. Despite that, the organization is obliged to enhance the DSS process, due to the current maturity 
level is quite distant from the desired level, 1.e., level 4 (predictable). The most significant gap exists in 
DSS03 (manage problem) domain, in which the maturity level is 3.26. In contrast, the smallest gap is shown 
in the DSSO6 domain which scales 3.44. This signifies the importance of the personnels’ knowledge upgrade 
in handling IT service issues by engaging in training, apprenticeship, and certification. On top of that, it 
needs full commitment from all academicians to ensure the information availability and ease of access within 
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each work unit. By that, it is essential for the organization to implement well-prepared planning and to 
execute the planning consistently in order to comply with organizational strategy and goals. 
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